Notice of Privacy Practices

Navigate Care provides care navigation and advocacy services, including services covered under Medicare. We are required by the Health Insurance Portability and Accountability Act (“HIPAA”) to protect the privacy of your health information — called Protected Health Information, or “PHI” — to give you this notice of our legal duties and privacy practices, and to follow the version of this notice currently in effect.

PHI is information that can identify you and that relates to your health, the care you receive, or payment for that care.

We may use and share your PHI without your written permission for three core purposes:

Treatment. To coordinate your care. For example, your advocate may share information with your doctors, pharmacies, hospitals or home health agencies so everyone involved in your care has what they need.

Payment. To bill and collect payment for our services. For example, we may share information with Medicare or your health plan to confirm coverage and submit claims.

Operations. To run and improve our service. For example, reviewing the quality of the support our advocates provide, or training our care team. We may also create de-identified data that can no longer identify you.

In certain situations, the law permits or requires us to share PHI without your written permission:

People involved in your care. With a family member, friend or personal representative you have identified, limited to what is relevant to their involvement in your care — you decide who, and how much.

Companies that work for us. With service providers (“business associates”) that help us operate — for example billing or technology vendors. They are bound by contract and by law to protect your PHI.

Public health and safety. To public health authorities, to report suspected abuse or neglect as required by law, or to prevent a serious threat to anyone's health or safety.

As required by law. In response to court orders, lawful subpoenas, law enforcement requests, health oversight activities such as audits and inspections, and workers' compensation programs.

Other limited situations. To coroners, medical examiners or funeral directors; for organ donation; for approved research with privacy safeguards; for disaster relief; for certain military, veterans and national security purposes; and, if you are in custody, to a correctional institution as needed for health and safety.

Some kinds of information — for example mental health records, substance-use treatment records, HIV status and genetic information — receive extra protection under state and federal law, and we follow those stricter rules where they apply.

For anything beyond what this notice describes, we need your written authorization first. In particular, we will always ask before:

• Using your PHI for marketing purposes
• Selling your PHI — which, to be clear, we simply do not do
• Sharing psychotherapy notes, where applicable

You can revoke an authorization at any time, in writing. From that point on we will stop the use or sharing it covered, except where we have already acted on it.

See and get a copy of your records. You can ask for a copy of the PHI we hold about you, on paper or electronically, and ask us to send a copy to someone you designate. In limited cases we may deny access, and you may ask for that denial to be reviewed.

Ask us to correct your records. If you believe information we hold is wrong or incomplete, you can ask us to amend it.

Ask us to limit what we share. You can request restrictions on how we use or share your PHI. We are not always required to agree — but if you paid for a service entirely out of pocket, you can require us not to tell your health plan about it.

Choose how we contact you. You can ask us to reach you a certain way — a different phone number, address or email. Note that ordinary email is not encrypted, so there is some risk if you choose it.

Get a list of disclosures. You can request an accounting of certain disclosures of your PHI we have made in the past six years.

Get a paper copy of this notice. At any time, even if you agreed to receive it electronically.

Be notified of a breach. If your unsecured PHI is ever involved in a breach, we will notify you as the law requires.

If you have a question about this notice or how we handle your information, contact us at privacy@trynavigate.care.

If you believe your privacy rights have been violated, you may file a complaint with us at the address above, or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will never retaliate against you for filing a complaint — asking hard questions is exactly what we teach families to do.

We may update this notice from time to time, and the new version will apply to all PHI we maintain. When we make a material change, we will post the updated notice on this page with a new effective date, and provide a copy on request.